Check Point UTM-1 Edge User Manual page 413

Null Payload
Some worms, such as Sasser, use ICMP echo request packets with null payload to detect
potentially vulnerable hosts.
You can configure how null payload ping packets should be handled.
Table 79: Null Payload Fields
In this field... Do this...
Action Specify what action to take when null payload ping packets are detected, by
selecting one of the following:
•
•
Track Specify whether to log null payload ping packets, by selecting one of the
following:
•
•
Chapter 13: Using SmartDefense
Block. Block the packets. This is the default.
None. No action.
Log. Log the packets. This is the default.
None. Do not log the packets.
SmartDefense Categories
399